API Release Notes, February 2026

New This Month

Now Available: Detokenizer (DTK) v5

The FIPS Compliant v5 Credit Card Detokenization API is available for all environments as well as CCPS for IBCP corporate card customers. This compliance-driven initiative aligns with the Federal Information Processor Standards (FIPS) to ensure robust protection of sensitive data, per U.S. federal requirements. For customers with entities in these environments with individually billed, company paid (IBCP) card programs, the Detokenizer (DTK) functionality will be integral to their payment allocation process when reimbursing their corporate card programs outside of SAP Concur platform.

Overview

The Detokenizer service ensures secure transmission of sensitive data (card number) to customers as part of the remittance file creation process running at caller applications like ICS and CWS, in which the full, unmasked credit card number is required for the correct application of payments.

API Details

The Detokenizer v5 API exposes the following resources and these must be called sequentially:

The first resource RSAPublicKey will return the RSA public key and version for the RSA public key. The caller needs to encrypt their symmetric key using this public key. This encrypted symmetric key and version needs to be passed to the “Credit Card Account Details” resource, along with the required Credit Card GUID parameter to retrieve the encrypted credit card account number. The Credit Card GUID parameter can be retrieved from cardAccountID value available in the Financial Integration Service (FIS) payload.

Important! Upcoming Shutdown of Request V1, V3, and V3.1

As previously announced, the Concur Request APIs v1.0, v3.0, and v3.1 have been decommissioned. These versions will be retired and no longer accessible as of August 5, 2026. Customers currently using these versions must migrate to the successor API, Request API V4, to ensure uninterrupted functionality. Please reach out to your Concur representative for more information.

Now Available: Bi-Directional Tax Integration Guide

Use the Bi-Directional Tax Integration guide for implementing the Expense V4 API. Explore the API Guides section for more resources.

Now Available: Hotel Recommendations in Hotel Service v4 Search Response

The Search response of Hotel Service v4 includes a field that allows hotel connectors to pass recommendation reasons for up to three properties. If populated, the property will be highlighted in the Hotel Results display to the customer and a pop-up will appear with the values that were sent in the response. The enum values for the recommendation reasons that are currently offered are listed below. Up to three values can be sent back for each property.

],
    "recommendationReasons": [
    "BOOKED_PREVIOUSLY_BY_TRAVELER",
    "LOYALTY_MEMBER",
    "CLOSEST_TO_COMPANY_LOCATION"
    ]
}

Preview: API Deprecation Headers

For APIs in deprecation, responses may include an x-api-warn header that identifies the deprecated endpoint and its recommended replacement. A sunset header will specify the planned decommission date and include a link to additional deprecation details, in compliance with SAP API policies. This will be applied to both API and UI gateways. For example:

• x-api-warn: ‘/api/v3.1/travelrequest/’ is deprecated; use ‘/travelrequest/v4/’. See ‘https://developer.concur.com/tools-support/release-notes/api/archive/2023-01-05.html’ for details.

• sunset: Sun, 01 Mar 2020 00:00:00 GMT

Preview: Groundspan Trip Extras v4

The Trip Extras v4 API will offer travelers ground transportation booking options through a redirect to Groundspan.This feature will replace the legacy Groundspan Direct Connect. This redirect will require the consumption of the following APIs: Event Subscription Service v4, Concur Travel Booking Events, Identity Change Event,Identity v4, Travel Extension v4, Travel Profile v2, Receipts v4.

Ongoing

Preview: Removal of concur.profile and concur.app Fields from Access Tokens(JWTs)

Two fields will be removed from Access Tokens (JWTs) and ID Tokens: concur.profile and concur.app. These fields currently contain fully formed URLs pointing to Profile v1 resources, for example:

• https://integration.api.concursolutions.com/profile/v1/principals/
• https://integration.api.concursolutions.com/profile/v1/apps/

These fields are being removed because the referenced URLs are no longer valid following the transition from Profile V1 to Profile v4. Also, these URLs were provided for convenience only and can be constructed using other information available in the JWT.

Target Dates

• Removal from Integration environments — week of March 23
• Removal from Production environments — week of April 6

Required Action

If your integration consumes either the concur.profile or concur.app fields from a JWT, update your implementation to remove this dependency by forming the necessary URL directly in your code.

Previews

In general, this table lists items that will be shipping in the next 30-60 days. For a broader view of features that are coming, please see our Road Map Explorer.

Deprecations and Decommissions

APIs are being deprecated or decommissioned in accordance with the SAP Concur API Lifecycle & Deprecation Policy.